HTTP

HTTP has already been discussed in the previous page. Let's talk about HTTP response and request here along with the headers used.

HTTP Requests and Responses

HTTP communications mainly consist of an HTTP request and an HTTP response. An HTTP request is made by the client (e.g. cURL/browser), and is processed by the server (e.g. web server).

HTTP request

HTTP response

HTTP Headers

HTTP headers pass information between the client and the server. Some headers are only used with either requests or responses, while some other general headers are common to both.

Header Types

1. General headers

2. Entity headers

3. Request headers

4. Response headers

5. Security headers

General Headers

They are common in both HTTP requests and responses.

Date	Date: Wed, 16 Feb 2022 10:38:44 GMT	Holds the date and time at which the message originated.
Connection	Connection: close Connection: keep-alive	Dictates whether the network connection between the client and the server should remain open or be closed after the current transaction.

Entity Headers

They are common in both requests and responses and are used to describe the content (entity) transferred by the message.

Content-Type	Content-Type: text/html	Indicates the media type (MIME type) of the resource being sent
Media-Type	Media-Type: application/pdf	A standardized identifier used in HTTP to specify the nature and format of a file or data
Boundary	boundary="b4e4fbd93540"	Used in multipart/form-data to separate different parts of the data
Content-Length	Content-Length: 385	Indicates the size of the message body, in bytes
Content-Encoding	Content-Encoding: gzip	Indicates the type of encoding (compression) that has been applied to the data in the response body

Request Headers

These headers are used specifically in HTTP requests.

Host	Host: www.inlanefreight.com	Specifies the domain name of the server to which the request is being sent
User-Agent	User-Agent: curl/7.77.0	Identifies the client software (browser, tool, or app) making the request
Referer	Referer: http://www.inlanefreight.com/	Indicates the URL of the webpage that linked to the resource being requested or informs the server of the page from which the client was referred
Accept	Accept: */*	Specifies the media types (MIME types) that the client is willing to receive from the server in the response and the */* value signifies that all media types are accepted.
Cookie	Cookie: PHPSESSID=b4e4fbd93540	It used to send stored cookies from the client (typically a web browser) to the server
Authorization	Authorization: BASIC cGFzc3dvcmQK	Used to provide credentials that authenticate the client to the server and also contains the type of authentication being used (e.g., Basic, Bearer, Digest) which are related to the credentials

Response Headers

These headers are used specifically in HTTP responses.

Server	Server: Apache/2.2.14 (Win32)	Provides information about the software and version of the web server handling the reques
Set-Cookie	Set-Cookie: PHPSESSID=b4e4fbd93540	It is used in HTTP responses to send cookies from the server to the client (typically a web browser)
WWW-Authenticate	WWW-Authenticate: BASIC realm="localhost"	Indicates the authentication scheme that should be used to access a resource and is typically sent by the server when it returns a 401 Unauthorized status code

Security Headers

These headers are used to enhance the security of the web-applications and protect from different web-based attacks.

Content-Security-Policy	Content-Security-Policy: script-src 'self'	Helps to prevent various types of attacks, such as Cross-Site Scripting (XSS) and data injection attacks
Strict-Transport-Security	Strict-Transport-Security: max-age=31536000	Helps to protect websites against man-in-the-middle attacks by instructing the web browsers to only communicate with the server over secure HTTPS connections
Referrer-Policy	Referrer-Policy: origin	Cntrols how much referrer information is included when navigating from a document to another resource

HTTP Methods and Codes

HTTP methods are a set of request methods that indicate the desired action to be performed on a specific resource on a web server.

The HTTP request methods are:

GET	Used to request data from a specified resource via query strings in the URL (e.g. ?param=value).
POST	Used to send data to the server to create or update a resource and is for sending information and uploading data to a website.
HEAD	Similar to GET, but it only retrieves the headers of the response without the body.
PUT	Used to update a resource or create a new resource if it does not exist
DELETE	Used to delete a specified resource on the server.
OPTIONS	Used to describe the communication options for the target resource.
PATCH	Applies partial modifications to the resource at the specified location.

The HTTP response codes are:

1xx	Indicate that the request was received and understood, and the server is continuing the process.
2xx	Returned when a request succeeds.
3xx	Returned when the server redirects the client.
4xx	Signifies improper requests from the client. For example, requesting a resource that doesn't exist or requesting a bad format.
5xx	Returned when there is some problem with the HTTP server itself.

Some common examples:

• 200 OK

• 302 Found

• 400 Bad Request

• 403 Forbidden

• 404 Not Found

• 500 Internal Server Error